AI Control Library / CF-12: Security & Abuse Resistance
Designation: Supplemental | Control types represented: Operational and Technical
Control requirement
Plan and manage AI infrastructure capacity against approved service objectives, resource budgets and realistic demand. Include inference cost drivers, training workloads and dependency limits.
Why this matters
AI demand varies with input size, output length and processing complexity. Average request volume can conceal memory exhaustion, queue growth and unpredictable cost.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply to compute, accelerators, storage, network, queues and external service quotas. Include shared capacity across tenants and environments.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The platform owner maintains capacity plans; service owners define priorities; finance and procurement approve resource allocations.
Implementation guidance
- Measure workload cost, concurrency, latency and dependency bottlenecks.
- Forecast normal demand, peaks and failure-related load.
- Set quotas, autoscaling ceilings and overload priorities.
- Load-test representative expensive cases and verify recovery.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Peak workload test | Service meets approved capacity criteria. |
| Autoscaling reaches ceiling | Costs remain bounded and overload is handled. |
| Shared-resource saturation | Critical workloads receive defined protection. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Capacity plan
- Load-test results
- Quota configuration
- Cost and saturation reviews
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Apply backpressure and workload priorities, stop unbounded consumption and obtain approval before expanding allocated resources.
Example in practice
Hypothetical example: A document-analysis service tests long scanned files rather than only short text requests. Results lead to separate queues and bounded accelerator capacity for expensive jobs.
Related controls
- CF13-010: Model Denial of Service Defense
- CF14-006: Autonomous Resource Acquisition Prevention
- CF12-S13: AI Infrastructure Security Policy
Framework mappings
- CSA AICM (I&S-02)
- NIST AI RMF (MANAGE 4.1)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Security & Abuse Resistance
Version 1.0